Is there a minimum size or revenue threshold?

No. The statute defines a small business, but that label only changes the compliance date. Small businesses had until June 30, 2024 for most obligations instead of March 31, 2024. Being small does not take you out of the law.

We are a HIPAA covered entity. Are we exempt?

Not automatically. The exemption in RCW 19.373.100 is written around categories of data, such as protected health information under HIPAA, not around types of organizations. Health-related data you hold outside of PHI, such as some website, marketing, or app data, may still be in scope. Confirm the boundary with your counsel.

Can we get consent through our terms of use?

No. The statute says consent cannot be obtained through acceptance of a general or broad terms of use agreement, by a consumer hovering over, muting, pausing, or closing content, or through deceptive designs. Consent must be a clear affirmative, opt-in act for a specified purpose.

How fast do we have to respond to a consumer request?

Within 45 days of receiving the request. The statute allows one extension of 45 more days when reasonably necessary, with notice to the consumer. Appeals also have a 45-day response window, and a denied appeal must tell the consumer how to contact the Attorney General.

Who enforces the law?

The Washington Attorney General enforces it under the Consumer Protection Act, and the Attorney General states that consumers can also bring private actions. The statute makes a violation an unfair or deceptive act under chapter 19.86 RCW.

Can CyberCascadia write our privacy policy or tell us whether the law applies?

We are not a law firm and do not give legal opinions. We do the operational work that counsel needs: mapping what health-related data you collect and where it goes, documenting security controls and access restrictions, and drafting operational procedures for counsel to review and finalize.

Washington My Health My Data Act Guide for Businesses

Q: Does the My Health My Data Act apply to my business if we are not a healthcare provider?

It can. The law applies to any legal entity that conducts business in Washington, or targets Washington consumers, and decides how consumer health data is collected, processed, shared, or sold. Consumer health data is defined broadly, so fitness, wellness, and app businesses can be covered even though they are not healthcare providers.

This is general information, not legal advice; CyberCascadia is not a law firm. Talk to your attorney about how the law applies to your business. Last reviewed against the statute and the Attorney General's guidance in October 2026.

What is the Washington My Health My Data Act?

The My Health My Data Act, codified at chapter 19.373 RCW, is a Washington privacy law for health-related data that HIPAA does not cover. It requires opt-in consent to collect and share that data, a separate consumer health data privacy policy, consumer access and deletion rights, and a signed authorization before any sale.

The Washington Attorney General describes it as the first privacy-focused law in the country to protect personal health data that falls outside HIPAA.

Does the My Health My Data Act apply to my business?

It applies if you are a "regulated entity": a legal entity that conducts business in Washington, or offers products or services targeted to Washington consumers, and that decides on its own or with others how consumer health data is collected, processed, shared, or sold. There is no minimum revenue or headcount that takes you out of scope.

Three definitions in RCW 19.373.010 do most of the work:

Consumer means a natural person who is a Washington resident, or a natural person whose consumer health data is collected in Washington. It does not include someone acting in an employment context, so employee data is outside this definition.
Regulated entity is described above. Government agencies and tribal nations are excluded.
Consumer health data means personal information linked or reasonably linkable to a consumer that identifies their past, present, or future physical or mental health status.

The Attorney General's FAQ adds that out-of-state processors working for regulated entities must also comply, and that an entity that only stores data in Washington is not a regulated entity for that reason alone.

Consumer health data is much broader than medical records

The statute lists thirteen categories of "physical or mental health status," and says the list is not exhaustive. They include:

Health conditions, treatment, diseases, or diagnoses, and health-related surgeries or procedures
Social, psychological, behavioral, and medical interventions
Use or purchase of prescribed medication
Bodily functions, vital signs, symptoms, or measurements of any of the listed information
Gender-affirming care information, and reproductive or sexual health information
Biometric data and genetic data
Precise location information that could reasonably indicate an attempt to get health services or supplies
Data that identifies a consumer seeking health care services
Information derived or inferred from non-health data, including by algorithms or machine learning, that is used to associate a consumer with any of the above

That last category matters. You do not have to ask a customer about their health to end up holding consumer health data. Inferences count.

Examples outside healthcare

Depending on the facts, the following can fall within the definition:

Fitness and wearables. Heart rate, step counts tied to a person, sleep data, and other "bodily functions, vital signs ... or measurements" from a device or app.
Wellness and symptom apps. The Attorney General specifically says apps that track digestion or perspiration collect consumer health data, while a toiletry purchase on its own generally does not.
Retail inferences. The Attorney General cites a "pregnancy prediction score" built from non-health purchases as an example of covered inferred data. Non-prescription purchases count only when the business infers a health status from them.

When did the My Health My Data Act take effect?

The law's main obligations took effect March 31, 2024 for most regulated entities and June 30, 2024 for small businesses. The geofencing ban took effect earlier, on July 23, 2023, for everyone. Both dates have passed, so if the law applies to you, you should already be in compliance.

Per the Attorney General's FAQ and the effective-date language in each section of the statute:

July 23, 2023: all persons, regardless of size, must comply with the geofencing prohibition (section 10 of the session law, now RCW 19.373.080).
March 31, 2024: regulated entities that are not small businesses must comply with the privacy policy, consent, consumer rights, access and security, processor, and sale requirements (RCW 19.373.020 through .070).
June 30, 2024: small businesses must comply with those same requirements.

A small business under the statute is a regulated entity that either handles consumer health data of fewer than 100,000 consumers in a calendar year, or gets less than 50 percent of gross revenue from consumer health data and handles that data for fewer than 25,000 consumers. The label changed your deadline. It did not exempt you.

What consent does the My Health My Data Act require?

You need the consumer's consent before you collect consumer health data for a specified purpose, and a separate consent before you share it, unless the collection or sharing is necessary to provide a product or service the consumer requested. Consent must be opt-in. Burying it in your terms of use does not count.

Under RCW 19.373.030, the request for consent must clearly disclose the categories of data, the purpose, who it will be shared with, and how the consumer can withdraw consent. The definition of consent in RCW 19.373.010 requires "a clear affirmative act" that is freely given, specific, informed, opt-in, voluntary, and unambiguous. It also lists what is not consent:

Accepting a general or broad terms of use agreement that bundles data processing with unrelated information
Hovering over, muting, pausing, or closing a piece of content
Agreement obtained through deceptive designs

Selling is stricter. RCW 19.373.070 makes it unlawful for any person to sell or offer to sell consumer health data without a signed "valid authorization" from the consumer. The authorization must be separate from any consent, must name the buyer and the purpose, expires one year after signing, and both seller and buyer must keep it for six years.

What goes in a consumer health data privacy policy?

You must maintain a separate consumer health data privacy policy and link to it prominently on your homepage. It must disclose what health data you collect, why, where it comes from, what you share and with whom, and how consumers exercise their rights. Your general privacy policy is not enough on its own.

Under RCW 19.373.020, the policy must clearly and conspicuously disclose:

The categories of consumer health data collected and the purpose of collection, including how it will be used
The categories of sources the data comes from
The categories of data shared, and the categories of third parties and specific affiliates you share with
How a consumer can exercise their rights under the law

You cannot collect, use, or share additional categories of data, or use data for additional purposes, that the policy does not disclose without first disclosing them and getting consent. The Attorney General's FAQ adds that the homepage link should be separate and distinct from your general privacy policy link, and that the consumer health data policy should not include information the Act does not require.

Consumer rights you have to support

RCW 19.373.040 gives consumers the right to confirm whether you collect, share, or sell their health data, to see it along with a list of third parties and affiliates it was shared with or sold to, to withdraw consent, and to have it deleted. Deletion requests must be passed to your processors and to third parties and affiliates you shared the data with. You must respond within 45 days, extendable once by 45 days when reasonably necessary, with notice and a reason given within the first 45 days. You cannot require a consumer to create a new account to make a request.

Access and security

RCW 19.373.050 requires you to restrict access to consumer health data to employees, processors, and contractors who need it for the consented purpose or requested service, and to maintain data security practices that at least satisfy a reasonable standard of care within your industry. This is where a written access model and documented controls do real work.

What does the My Health My Data Act say about geofencing?

It is unlawful for any person to set up a geofence around a place that provides in-person health care services when the geofence is used to identify or track people seeking care, collect consumer health data, or send them health-related messages or ads. The statute defines a geofence as a virtual boundary of 2,000 feet or less from the facility's perimeter.

See RCW 19.373.080 and the geofence definition in RCW 19.373.010. The ban applies to "any person," not only regulated entities, and it has applied since July 23, 2023. If you buy location-based advertising, ask your agency or ad platform directly whether any campaign targets the area around clinics, pharmacies, or other care locations.

What are the obligations for processors?

A processor, meaning a vendor that handles consumer health data on your behalf, may only process it under a binding contract that sets out processing instructions and limits what it can do with the data. A processor that goes beyond those instructions is treated as a regulated entity for that data, with all the obligations that follow.

Under RCW 19.373.060, processors must also help you meet your own obligations. In practice this means your marketing platforms, app developers, analytics vendors, and hosting providers need contract terms that match your consumer health data privacy policy. A contract inconsistent with that policy is itself a problem under RCW 19.373.020.

How is the My Health My Data Act enforced?

Violations are treated as unfair or deceptive acts under Washington's Consumer Protection Act, chapter 19.86 RCW. That gives the Attorney General enforcement authority and, according to the Attorney General, lets consumers bring their own private lawsuits. The private right of action is the main reason this law gets so much attention.

See RCW 19.373.090 and the Attorney General's FAQ, which confirms both AG enforcement and private actions.

How does the My Health My Data Act interact with HIPAA?

The statute exempts protected health information under HIPAA and certain other regulated health data, but the exemption is written around categories of data, not types of organizations. A HIPAA covered entity is not exempt as a whole. Health-related data it holds outside of PHI can still be consumer health data under Washington law.

RCW 19.373.100 exempts, among other things:

Protected health information for purposes of HIPAA and its related regulations
Health care information collected, used, or disclosed under chapter 70.02 RCW
Patient records covered by the federal substance use disorder confidentiality rules, 42 C.F.R. Part 2
Information deidentified under the HIPAA standard
Certain human subjects research data, quality improvement and peer review records, and public health data
Information originating from, and intermingled to be indistinguishable from, exempt information maintained by a HIPAA covered entity or business associate
Personal information governed by other laws, including the Gramm-Leach-Bliley Act, the Fair Credit Reporting Act, and FERPA

It also says the law does not restrict collecting, using, or disclosing consumer health data to prevent or respond to security incidents, fraud, or other illegal activity, and that the entity claiming that exemption bears the burden of showing it applies.

For a clinic or medical group, the practical question is: what health-related data do you hold that is not PHI? Common candidates include website analytics and ad tracking on appointment pages, marketing email lists segmented by service line, wellness program or retail product data, and app data that never enters the medical record. Mapping that boundary is the first step. If you are also working on your HIPAA obligations, our HIPAA Security Risk Assessment and the My Health My Data mapping can share the same data inventory.

My Health My Data Act compliance checklist

Use this as a working list with your counsel and your IT provider. Each item ties back to a section of the statute. Items marked for counsel involve legal judgment that CyberCascadia does not provide.

Decide whether you are in scope. List every way you collect information that could reveal health status, including inferences. Confirm with counsel whether you are a regulated entity and whether you meet the small business definition.
Build a data map. For each category of consumer health data: where it comes from, where it is stored, who can access it, which vendors receive it, how long you keep it, and whether any of it is HIPAA PHI or otherwise exempt.
Inventory website and app tracking. Identify pixels, SDKs, analytics, and ad tools on health-related pages and app screens, and what data they send to third parties.
Separate consent for collection and for sharing. Opt-in, specific to the purpose, with no reliance on terms of use or pre-checked boxes. Record when and how each consent was given. (Counsel reviews the language.)
Publish a consumer health data privacy policy. Separate from your general policy, with its own prominent homepage link. (Counsel drafts or approves.)
Stand up a consumer request process. Intake, identity verification, access, deletion including processors and recipients, consent withdrawal, appeals, and a 45-day clock you can track.
Restrict access and document reasonable security. Limit access to the people and vendors who need it, and have your IT provider implement and evidence controls such as MFA, encryption, logging, and backups appropriate to your industry.
Fix processor contracts. Every vendor that handles consumer health data on your behalf needs a binding contract with processing instructions consistent with your policy.
Check for geofencing and sales. Confirm no location-based targeting is set around in-person care locations, and if any arrangement could be a sale of health data, get counsel involved before it continues.
Review at least once a year, and whenever you add a new data category, app feature, or vendor.

Washington's My Health My Data Act: a guide for small businesses